GitHub - XieyangSun/TEMPEST-LoRa: TEMPEST-LoRa: Cross-Technology Covert Communication

TEMPEST-LoRa: Cross-Technology Covert Communication

This repository contains the source code and instructions for reproducing the results of "TEMPEST-LoRa: Cross-Technology Covert Communication", accepted to ACM CCS 2025.

📺 Demo Video

Watch our demonstration of TEMPEST-LoRa in action:

🔬 Overview

TEMPEST-LoRa demonstrates a novel cross-technology covert communication technique that exploits electromagnetic radiation (EMR) from video cables. By crafting malicious images or videos displayed on a monitor/projector/TV, we can cause the connected VGA or HDMI cable to emit electromagnetic radiation that encodes LoRa-compatible packets.

How It Works

1. Transmitter: A specially crafted video is displayed in full-screen mode on a monitor
2. Medium: The VGA/HDMI cable acts as an unintentional antenna, emitting EMR
3. Receiver: Commercial Off-The-Shelf (COTS) LoRa devices receive and decode the packets

Research Paper

📄 Published: ACM CCS 2025
📄 Preprint: arXiv:2506.21069

📰 Media Coverage

The following articles provide excellent summaries our work:

• 🔗 Hackaday - "Video Cable Becomes Transmitter With TEMPEST-LoRa"
• 🔗 RTL-SDR Blog - "TEMPEST-LoRa: Emitting LoRa Packets from VGA or HDMI Cables"
• 🔗 Hackster.io - "TEMPEST-LoRa Breaches Air-Gapped Systems with Video Cables"
• 🔗 Treadstone71 - "TEMPEST-LoRa Capabilities, Threats, and Strategic Implications in Modern Electronic Warfare"

✨ Key Features

• ✅ Cross-Technology Communication: Bridge display technology and LoRa wireless protocol
• ✅ COTS Hardware: Works with commercial LoRa devices (no custom hardware needed)
• ✅ Flexible Configuration: Supports multiple LoRa parameters (SF, BW, frequency)
• ✅ Ready-to-Use Samples: Pre-generated attack images and videos included
• ✅ Academic Research: Demonstrates novel side-channel communication technique

🛠️ Hardware Requirements

Transmitter Side (Tx)

• Computer with VGA or HDMI output
• Monitor/Projector/TV connected via VGA or HDMI cable
• Display Settings: Must be set to 1080×1920 @ 60Hz

Receiver Side (Rx)

Any Commercial Off-The-Shelf (COTS) LoRa device, in our paper, we used:

🚀 Quick Start

Prerequisites

• MATLAB (for generating attack videos)
• Arduino IDE (for SX1262 node setup)
• LoRa receiver hardware

Basic Workflow

1. Configure parameters in CrossConfigFile.m
2. Generate attack video using GenerateAttackVideo.m
3. Display video in full-screen mode on target monitor
4. Receive packets using configured LoRa device

For detailed instructions, see the sections below.

📡 EMR Transmitter Setup (MATLAB)

All transmitter scripts are located in the /EMR Tx folder.

1. Configure Global Parameters

File: CrossConfigFile.m

Sets the global parameters for the attack video.

Default Settings:

• Video resolution: 1080×1920 @ 60Hz
• EMR center frequency: 915 MHz
• LoRa Spread Factor (SF): 7
• LoRa Bandwidth (BW): 500 kHz
• LoRa Preamble length: 4

Usage:

Config = CrossConfigFile.getInstance;

2. Set Payload Symbols

File: GetLoRaPacketInfo.m

Defines the symbol sequence representing the payload to be encoded as EMR.

Default Payload (SF=6): "Hello, TEMPEST-LoRa"

Custom Payloads: Sample physical-layer symbol encoding sequences (SF6-SF12) are provided in /EMR Tx/PayloadSymbols.

To use a custom payload:

1. Load the desired symbol sequence from /PayloadSymbols/
2. Replace PacketInfo.Payload in GetLoRaPacketInfo.m with the loaded Index variable

Usage:

PacketInfo = GetLoRaPacketInfo;

3. Generate Attack Video

File: GenerateAttackVideo.m

Generates an attack video file named Attack-Video.avi in the current directory. Individual frames are saved in /EMR Tx/pics (1.png, 2.png, ..., x.png).

Usage:

GenerateAttackVideo(PacketInfo, Config);

Utility Scripts

CalculateChirpPoints.p and CalculateSFD.p

Calculate the pixel stream corresponding to each EMR chirp signal. These are used internally by GenerateAttackVideo.m to create the 1-D pixel stream, which is then reshaped into a 2-D attack image based on the configured resolution.

BlackPic.m

Generates black images for the first and last frames to mark video boundaries.

ReverseLoRaPacket.m

Analyzes chirps from captured physical-layer samples to extract encoded LoRa symbols (reverse-engineering aid).

Workflow:

1. Use a COTS LoRa device (e.g., SX1262) to transmit data packets
2. Capture physical-layer samples using USRP or SDR
3. Analyze chirp encoding with ReverseLoRaPacket.m
4. Manually save results to /EMR Tx/PayloadSymbols

ShowSpectrum.m

Visualizes the time-frequency graph of physical-layer signals (for debugging or calibration).

📻 LoRa Receiver Setup (COTS Devices)

Option 1: SX1262 LoRa Node

Setup Steps

1. Install Arduino IDE on Windows 10/11
2. Install RadioLib library (Documentation)
3. Connect SX1262 node to computer via USB
4. Upload program: Load SX1262_Receive_Interrupt.ino from RadioLib examples
5. Monitor reception: Open Tools → Serial Monitor to view received packets (Data, RSSI, SNR)

Configuration Parameters

The default parameters in SX1262_Receive_Interrupt.ino are configured to decode the samples in the AttackSamples folder:

radio.setFrequency(915);        // Center frequency (MHz)
radio.setBandwidth(500);        // LoRa bandwidth (kHz)
radio.setSpreadingFactor(7);    // Spreading factor (6-12)
radio.setCodingRate(5);         // Coding rate
radio.setPreambleLength(4);     // Preamble length

Reference: For Lilygo SX1262 devices, see the official tutorial.

Option 2: SX1302 LoRa Gateway

Hardware Setup

We tested with the Waveshare SX1302 LoRaWAN Gateway HAT on Raspberry Pi.

Software Setup

1. Configure SX1302_hal: Follow the SX1302_hal README

2. Reception Method 1 (Direct HAL):

   Navigate to /libloragw folder and run:

   ./test_loragw_hal_rx -a 915 -b 915 -m 1250

   Parameters:

   • -a, -b: Center frequency (MHz)
   • -m: Chip model (1250, 1255, or 1257, depending on your gateway)

3. Reception Method 2 (Packet Forwarder):

   Navigate to /packet_forwarder folder and run:

   ./lora_pkt_fwd -c global_conf.json.sx1250.US915

   Parameters:

   • -c: Configuration file (modify global_conf.json for custom settings)

🎯 Attack Samples

Pre-generated attack images and videos are provided in the /AttackSamples folder for quick reproduction.

Naming Convention

Files are named according to their configuration:

SF[SpreadFactor]_[Bandwidth]kHz_[Payload]_[CenterFreq]MHz_[FreqOffset]Offset.png

Example: SF6_500kHz_ABC_915MHz_+50kHzOffset.png

• Spread Factor: 6
• Bandwidth: 500 kHz
• Payload: "ABC"
• Center Frequency: 915 MHz
• Frequency Offset: +50 kHz

Available Configurations

Multiple frequency offset versions are provided for each configuration to account for hardware variations.

⚠️ Important Notes

1. Academic and Educational Use Only

2. Display Settings

3. Full-Screen Display

4. Frequency Calibration

5. Protected Code

📚 Citation

If you find this work useful in your research, please cite:

@inproceedings{TEMPEST-LoRa,
  title={TEMPEST-LoRa: Cross-Technology Covert Communication},
  author={Xieyang Sun and Yuanqing Zheng and Wei Xi and Zuhao Chen and Zhizhen Chen and Han Hao and Zhiping Jiang and Sheng Zhong},
  booktitle={Proceedings of the ACM Conference on Computer and Communications Security (CCS)},
  year={2025}
}

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.